Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.111a8ebb-d47b-4682-9d9b-f7b117ccb2c4
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\icarus-info.xml
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.43dac409-dc22-4e99-a263-e628a566e5b8
- %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- %PROGRAMDATA%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\product-def.xml
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\setupui.cont
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\product-info.xml
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\setupui.cont
- %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.39193cb5-9148-4f0c-9cc8-42e5988340a3
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\2eaa792a-0bb4-4ffb-9fc4-d6558ed987d3
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\64e1ee1b-72e1-465b-bbf8-95f3dae60e99
- %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\597fed3a-02ae-45de-9dac-024f3372b931
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\product-info.xml
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\b080095e-497d-45ae-942d-b8fc25c34acf
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\cd6e3245-977d-45b2-b567-3f1e7f117e9c
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus_product.dll
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\b7a25c88-da0c-4379-ba4a-9b4279deacfd
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus_ui.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\04914534-9107-4bef-bde8-e4294feeb4d0
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\3f04063b-583c-45ec-a76f-b861992fed8b
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\dump_process.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\7bb4513b-5065-485c-ad96-d42b4e5d4c85
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\bug_report.exe
- %WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\product-def.xml
- %PROGRAMDATA%\avast software\icarus\logs\sui.log
Moves the following files
- from %PROGRAMDATA%\avast software\icarus\logs\sfx.log.tmp.111a8ebb-d47b-4682-9d9b-f7b117ccb2c4 to %PROGRAMDATA%\avast software\icarus\logs\sfx.log
- from %PROGRAMDATA%\avast software\icarus\logs\icarus.log.tmp.43dac409-dc22-4e99-a263-e628a566e5b8 to %PROGRAMDATA%\avast software\icarus\logs\icarus.log
- from %PROGRAMDATA%\avast software\icarus\logs\sui.log.tmp.39193cb5-9148-4f0c-9cc8-42e5988340a3 to %PROGRAMDATA%\avast software\icarus\logs\sui.log
Network activity
TCP
HTTP GET requests
- http://ho####.avcdn.net/dll/avast-tu/x86/icarus_mod.dll.lzma
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\icarus-info.xml /install
- '%WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus.exe' /er_master:master_ep_d84defcf-8f3e-48c1-8a64-2905c8973cb0 /er_ui:ui_ep_27a88e7a-f9b1-430c-bfdd-482e299204e9 /er_slave:avast-tu_slave_ep_2be3976b-3d1d-4aa9-802e-6785b26d8dc1 /slave:avast-tu
- '%WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus_ui.exe' /er_master:master_ep_d84defcf-8f3e-48c1-8a64-2905c8973cb0 /er_ui:ui_ep_27a88e7a-f9b1-430c-bfdd-482e299204e9
- '%WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\avast-tu\icarus.exe' /er_master:master_ep_d84defcf-8f3e-48c1-8a64-2905c8973cb0 /er_ui:ui_ep_27a88e7a-f9b1-430c-bfdd-482e299204e9 /er_slave:avast-tu_slave_ep_2be3976b-3d1d-4aa9-802e-6785b26d8dc1 /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-8073dbea-ffb3-40ac-bb91-8cf2c4c5f73c\common\icarus_ui.exe' /er_master:master_ep_d84defcf-8f3e-48c1-8a64-2905c8973cb0 /er_ui:ui_ep_27a88e7a-f9b1-430c-bfdd-482e299204e9' (with hidden window)
